Security AlertHigh
cPGuard update channel hijacked; Linux servers got backdoor script
Nov 3, 2026 · Summarized by Fundy Tech from The Hacker News
The 30-second version
OPSSHIELD says an attacker used compromised credentials to push a malicious cPGuard update on November 2. The script installed a backdoor and copied hashes and other files.
Key points
- Affected versions were 5.88.12 through 5.88.19.
- cPGuard 5.88.25 and later removes the backdoor and files.
- OPSSHIELD says 32 files were taken from one server.
Why it matters
If you run cPGuard, your server may need more than a software update. Passwords and keys may need replacing because copied credentials could still work after patching.
Who’s affected: Linux servers that installed cPGuard 5.88.12-5.88.19
Original reporting
Not sure if this affects you?
Fundy Tech helps businesses and households across Atlantic Canada stay patched, protected and up to speed. Tell us what you’re running and we’ll tell you straight whether you need to act.